@andrewheberle/serverless-ssh-ca 0.17.18 → 0.17.19

package/dist/sshsig/sig_parser.js

@@ -1,6 +1,62 @@
 import { Reader } from "./reader";
 import { parsePubkey } from "./formats";
 import { dearmor } from "./armor";
+/**
+ * Narrow a signature algorithm name to an {@link EcdsaSigAlgo}.
+ *
+ * @param sig_algo Signature algorithm name from the SSH signature.
+ */
+export function isEcdsaSigAlgo(sig_algo) {
+    return sig_algo === "ecdsa-sha2-nistp256" ||
+        sig_algo === "ecdsa-sha2-nistp384" ||
+        sig_algo === "ecdsa-sha2-nistp521" ||
+        sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com";
+}
+/**
+ * Size in bytes of each of the r and s signature components for the curve
+ * used by an {@link EcdsaSigAlgo}.
+ *
+ * @param sig_algo ECDSA signature algorithm name.
+ */
+export function ecdsaComponentSize(sig_algo) {
+    switch (sig_algo) {
+        case "ecdsa-sha2-nistp256":
+        case "sk-ecdsa-sha2-nistp256@openssh.com":
+            return 32;
+        case "ecdsa-sha2-nistp384":
+            return 48;
+        case "ecdsa-sha2-nistp521":
+            return 66;
+        default: {
+            const exhaustive = sig_algo;
+            throw new Error(`unsupported ECDSA signature algorithm: ${exhaustive}`);
+        }
+    }
+}
+/**
+ * Convert an SSH mpint encoded ECDSA signature component (r or s) to a
+ * fixed-width big-endian value of `size` bytes.
+ *
+ * Leading zero bytes are removed and the value is then left-padded with
+ * zeros to `size`. This throws an Error when the value is zero or does not
+ * fit in `size` bytes.
+ *
+ * @param mpint Component bytes as encoded in the SSH signature.
+ * @param size Required width in bytes, see {@link ecdsaComponentSize}.
+ */
+export function toFixedWidth(mpint, size) {
+    let start = 0;
+    while (start < mpint.length && mpint[start] === 0x00) {
+        start++;
+    }
+    const value = mpint.subarray(start);
+    if (value.length === 0 || value.length > size) {
+        throw new Error("invalid ECDSA signature component");
+    }
+    const out = new Uint8Array(size);
+    out.set(value, size - value.length);
+    return out;
+}
 /**
  * Parse bytes into an SSH signature object.
  *
@@ -37,24 +93,16 @@ export function parse(signature) {
     const sig_algo = raw_signature.readString().toString();
     const sig_bytes = raw_signature.readString();
     let bytes;
-    if (sig_algo === "ecdsa-sha2-nistp256" || sig_algo === "ecdsa-sha2-nistp384" ||
-        sig_algo === "ecdsa-sha2-nistp512" ||
-        sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-        let r = new Uint8Array(sig_bytes.readString().bytes());
-        if (r.length === 0) {
-            throw new Error("invalid ECDSA signature component");
-        }
-        if (r[0] === 0x00 && r.length % 2 == 1) {
-            r = r.slice(1);
-        }
-        let s = new Uint8Array(sig_bytes.readString().bytes());
-        if (s.length === 0) {
-            throw new Error("invalid ECDSA signature component");
-        }
-        if (s[0] === 0x00 && s.length % 2 == 1) {
-            s = s.slice(1);
-        }
-        bytes = new Uint8Array([...r, ...s]).buffer;
+    if (isEcdsaSigAlgo(sig_algo)) {
+        // SSH encodes r and s as minimal-length mpints, but WebCrypto expects
+        // the fixed-width concatenation r || s
+        const size = ecdsaComponentSize(sig_algo);
+        const r = toFixedWidth(new Uint8Array(sig_bytes.readString().bytes()), size);
+        const s = toFixedWidth(new Uint8Array(sig_bytes.readString().bytes()), size);
+        const raw = new Uint8Array(size * 2);
+        raw.set(r, 0);
+        raw.set(s, size);
+        bytes = raw.buffer;
     }
     else {
         bytes = sig_bytes.bytes();

package/dist/sshsig/sig_parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sig_parser.js","sourceRoot":"","sources":["../../src/sshsig/sig_parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,SAA4B;IAChD,IAAI,IAAI,CAAC;IACT,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC;IACV,IACE,QAAQ,KAAK,qBAAqB,IAAI,QAAQ,KAAK,qBAAqB;QACxE,QAAQ,KAAK,qBAAqB;QAClC,QAAQ,KAAK,oCAAoC,EACjD,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAqB,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,EAAE,OAAO,CAAC;IACnB,IACE,QAAQ,KAAK,oCAAoC;QACjD,QAAQ,IAAI,4BAA4B,EACxC,CAAC;QACD,KAAK,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,SAAS;QACT,QAAQ;QACR,cAAc;QACd,SAAS,EAAE;YACT,QAAQ;YACR,aAAa,EAAE,KAAK;YACpB,KAAK;YACL,OAAO;SACR;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sig_parser.js","sourceRoot":"","sources":["../../src/sshsig/sig_parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAYlC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,QAAQ,KAAK,qBAAqB;QACvC,QAAQ,KAAK,qBAAqB;QAClC,QAAQ,KAAK,qBAAqB;QAClC,QAAQ,KAAK,oCAAoC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,oCAAoC;YACvC,OAAO,EAAE,CAAC;QACZ,KAAK,qBAAqB;YACxB,OAAO,EAAE,CAAC;QACZ,KAAK,qBAAqB;YACxB,OAAO,EAAE,CAAC;QACZ,SAAS,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,IAAY;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,KAAK,EAAE,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,SAA4B;IAChD,IAAI,IAAI,CAAC;IACT,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC;IACV,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,sEAAsE;QACtE,uCAAuC;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjB,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,EAAE,OAAO,CAAC;IACnB,IACE,QAAQ,KAAK,oCAAoC;QACjD,QAAQ,IAAI,4BAA4B,EACxC,CAAC;QACD,KAAK,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,SAAS;QACT,QAAQ;QACR,cAAc;QACd,SAAS,EAAE;YACT,QAAQ;YACR,aAAa,EAAE,KAAK;YACpB,KAAK;YACL,OAAO;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/sshsig/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/sshsig/writer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAW;gBACX,aAAa,EAAE,MAAM;IAMjC,OAAO,CAAC,SAAS;IAKjB,WAAW,CAAC,GAAG,EAAE,MAAM;IAKvB,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM;IAI7C,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,WAAW;IAmB1D,SAAS,CAAC,IAAI,EAAE,MAAM;IAItB,KAAK;CAGN"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/sshsig/writer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAW;IACvB,YAAY,aAAa,EAAE,MAAM,EAKhC;IACD,OAAO,CAAC,SAAS;IAKjB,WAAW,CAAC,GAAG,EAAE,MAAM,QAItB;IACD,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,QAG5C;IACD,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,WAAW,QAkBzD;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,QAGrB;IACD,KAAK,4BAEJ;CACF"}

package/dist/utils.d.ts

@@ -12,6 +12,13 @@ type AccessToken = {
 };
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
 export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Key | never;
+/**
+ * Thrown by {@link identityPrincipals} when the principals claim of an
+ * identity token is not a string or an array of strings.
+ */
+export declare class PrincipalsClaimError extends Error {
+    constructor(message: string);
+}
 export declare const identityPrincipals: (env: SshCaBindings, payload: CertificateRequestJWTPayload, claim?: string) => string[];
 type IdentityToken = {
     sub: string;
@@ -56,6 +63,25 @@ type ParsedRevokeCertificate = {
 };
 export declare const refineRevokeCertificate: (env: SshCaBindings, val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
 export declare const split: (v?: string | string[]) => string[];
+/**
+ * Thrown by {@link getPrivateKey} when the CA private key is of a type that
+ * cannot be used.
+ */
+export declare class UnsupportedKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Load and parse the CA private key from the `PRIVATE_KEY` secret.
+ *
+ * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
+ * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
+ * later refuse by default, and because RSA keys in OpenSSH format are
+ * converted with invalid CRT parameters that the Workers runtime rejects.
+ *
+ * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
+ */
+export declare const getPrivateKey: (env: SshCaBindings) => Promise<PrivateKey>;
 export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<Key>;
 export {};
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,GAAG,EAAqF,UAAU,EAAE,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,SAAS,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AAIpD,eAAO,MAAM,UAAU,GAAI,KAAK,CAAC,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAyCrI,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,EAAE,SAAS,4BAA4B,EAAE,QAAQ,MAAM,KAAG,MAAM,EA0BpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,GAAG,SAAS,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,KAAK,aAAa,EAAE,KAAK,wBAAwB,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,GAAI,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,WAAW,OAAO,WAAW,EAAE,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAoC5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,GAAU,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,GAAI,IAAI,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED,eAAO,MAAM,SAAS,GAAU,KAAK,aAAa,EAAE,MAAM,UAAU,KAAG,OAAO,CAAC,GAAG,CAejF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,GAAG,EAAqF,UAAU,EAAE,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,SAAS,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AAKpD,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA+C5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAY1E,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,GAAG,CAWjF,CAAA"}

package/dist/utils.js

@@ -1,10 +1,11 @@
-import { JWKInvalid, JWKSInvalid, JWSInvalid, JWTClaimValidationFailed, JWTInvalid } from "jose/errors";
+import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors";
 import { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } from "sshpk";
 import z from "zod";
 import { verifyJWT } from "./verify";
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof";
 import { logger } from "./logger";
 import { ms } from "itty-time";
+import { InternalServerErrorException } from "chanfana";
 export const fatalIssue = (ctx, message, val) => {
     ctx.issues.push({
         code: "custom",
@@ -70,7 +71,11 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
             case (err instanceof JWKSInvalid):
                 return fatalIssue(ctx, "the access token JWKS was invalid", val);
             case (err instanceof JWTClaimValidationFailed):
-                return fatalIssue(ctx, "claim validtion of the JWT failed", val);
+                return fatalIssue(ctx, "claim validation of the JWT failed", val);
+            case (err instanceof JWTExpired):
+                return fatalIssue(ctx, "the access token has expired", val);
+            case (err instanceof JWSSignatureVerificationFailed):
+                return fatalIssue(ctx, "the access token signature verification failed", val);
             default:
                 l.error("unhandled access token validation error", "in", "transformAuthorizationHeader", "error", err);
                 return fatalIssue(ctx, "unhandled access token validation error", val);
@@ -108,16 +113,38 @@ export const transformPublicKey = (val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Thrown by {@link identityPrincipals} when the principals claim of an
+ * identity token is not a string or an array of strings.
+ */
+export class PrincipalsClaimError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PrincipalsClaimError";
+        Object.setPrototypeOf(this, PrincipalsClaimError.prototype);
+    }
+}
+const PrincipalsClaimSchema = z.union([z.string(), z.array(z.string())]).nullish();
 export const identityPrincipals = (env, payload, claim) => {
     if (claim === undefined) {
         claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM;
     }
     const l = logger(env);
-    const p = payload[claim];
+    // the token is verified but the claim type is set by the IdP
+    const parsed = PrincipalsClaimSchema.safeParse(payload[claim]);
+    if (!parsed.success) {
+        l.warn("claim was not a string or an array of strings", "claim", claim);
+        throw new PrincipalsClaimError(`the ${claim} claim must be a string or an array of strings`);
+    }
+    const p = parsed.data;
     if (p === undefined) {
         l.warn("claim was missing despite being set in CA config", "claim", claim);
         return [];
     }
+    if (p === null) {
+        l.warn("claim was present but was null", "claim", claim);
+        return [];
+    }
     if (p === "") {
         l.warn("claim was present but was an empty string", "claim", claim);
         return [];
@@ -125,7 +152,7 @@ export const identityPrincipals = (env, payload, claim) => {
     // make sure its always a string[] and replace any spaces with underscores
     const principals = (typeof p === "string" ? [p] : p)
         .map((value) => value.replaceAll(" ", "_"));
-    l.info("identity token included principals", "principals", principals);
+    l.debug("identity token included principals", "principals", principals);
     return principals;
 };
 export const parseIdentity = async (env, jwt, claim) => {
@@ -145,10 +172,10 @@ export const transformIdentityToken = async (env, val, ctx) => {
         const identity = await parseIdentity(env, val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM);
         return identity;
     }
-    catch {
+    catch (err) {
         ctx.issues.push({
             code: "custom",
-            message: "problem parsing identity token",
+            message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
             input: val
         });
         return z.NEVER;
@@ -256,10 +283,16 @@ export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) =>
         if (!val.certificate.isSignedByKey(issuer)) {
             return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
         }
-        // check certificate is not expired
-        if (val.certificate.isExpired()) {
+        // check certificate is within its validity period, allowing for clock
+        // skew at the start as a certificate issued moments ago may have a
+        // validity start up to a second in the future
+        const now = Date.now();
+        if (now >= val.certificate.validUntil.getTime()) {
             return fatalIssue(ctx, "the provided certificate is expired", val);
         }
+        if (val.certificate.validFrom.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
+            return fatalIssue(ctx, "the provided certificate is not yet valid", val);
+        }
         // ensure certificate presented for renewal is not revoked
         const serial = val.certificate.serial.readBigUInt64BE(0);
         if (await isRevoked(env, serial)) {
@@ -277,6 +310,11 @@ export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) =>
         return z.NEVER;
     }
     catch (err) {
+        // a misconfigured CA key is a server error, not a validation failure
+        if (err instanceof UnsupportedKeyError) {
+            l.error(err.message, "in", "refineHostCertificateRenewal");
+            throw new InternalServerErrorException(err.message);
+        }
         l.error("proof of possession verification unhandled error", "in", "refineHostCertificateRenewal", "error", err);
         return fatalIssue(ctx, "proof of possession verification unhandled error", val);
     }
@@ -309,12 +347,41 @@ export const split = (v) => {
                 : v.split(",")
             : v;
 };
+/**
+ * Thrown by {@link getPrivateKey} when the CA private key is of a type that
+ * cannot be used.
+ */
+export class UnsupportedKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsupportedKeyError";
+        Object.setPrototypeOf(this, UnsupportedKeyError.prototype);
+    }
+}
+/**
+ * Load and parse the CA private key from the `PRIVATE_KEY` secret.
+ *
+ * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
+ * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
+ * later refuse by default, and because RSA keys in OpenSSH format are
+ * converted with invalid CRT parameters that the Workers runtime rejects.
+ *
+ * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
+ */
+export const getPrivateKey = async (env) => {
+    // grab private key from secret store
+    const secret = await env.PRIVATE_KEY.get();
+    // parse it
+    const key = parsePrivateKey(secret);
+    if (key.type !== "ed25519" && key.type !== "ecdsa") {
+        throw new UnsupportedKeyError(`CA key type ${key.type} is not supported, the CA key must be Ed25519 or ECDSA`);
+    }
+    return key;
+};
 export const getPublic = async (env, key) => {
     if (key === undefined) {
-        // grab private key from secret store
-        const secret = await env.PRIVATE_KEY.get();
-        // parse it
-        key = parsePrivateKey(secret);
+        key = await getPrivateKey(env);
     }
     // convert to a public key and add comment
     const pub = key.toPublic();

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvG,OAAO,EAAoB,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAc,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEpC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAE3F,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAe,EAAE;IAC9G,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE1F,OAAO,GAAG,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAEzB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEtE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAuB,EAAE;IACxH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAEjI,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,GAAG,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,mCAAmC;QACnC,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAgB,EAAE;IACrF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;QAE1C,WAAW;QACX,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAA;IAE3B,iDAAiD;IACjD,OAAO,GAAG,CAAA;AACX,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAoB,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAc,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEpC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAE3F,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAe,EAAE;IAC9G,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE1F,OAAO,GAAG,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC7F,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAuB,EAAE;IACxH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAEjI,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,GAAG,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;YAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,WAAW;IACX,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAEnC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,IAAI,wDAAwD,CAAC,CAAA;IAC/G,CAAC;IAED,OAAO,GAAG,CAAA;AACX,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAgB,EAAE;IACrF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAA;IAE3B,iDAAiD;IACjD,OAAO,GAAG,CAAA;AACX,CAAC,CAAA"}

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5C,KAAK,aAAa,GAAG;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,SAAS,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,OAAM,aAAkB,uGAexF,CAAA"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5C,KAAK,aAAa,GAAG;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,OAAO,MAAM,SAAQ,aAAa,uGAenF,CAAA"}

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAM/B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,OAAsB,EAAE,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE7D,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;SAClB,CAAC,CAAA;IACH,CAAC;IAEE,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;KACxC,CAAC,CAAA;AACN,CAAC,CAAA"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAM/B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,IAAI,GAAkB,EAAE,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE7D,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;SAClB,CAAC,CAAA;IACH,CAAC;IAEE,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;KACxC,CAAC,CAAA;AACN,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.17.18",
+	"version": "0.17.19",
 	"description": "A serverless SSH CA built on Cloudflare Workers",
 	"type": "module",
 	"types": "./dist/index.d.ts",
@@ -31,7 +31,7 @@
 	},
 	"dependencies": {
 		"@andrewheberle/ts-slog": "^1.3.0",
-		"@cloudflare/workers-types": "^4.20260528.1",
+		"@cloudflare/workers-types": "^5.0.0",
 		"chanfana": "^3.0.0",
 		"hono": "^4.10.6",
 		"itty-time": "^2.0.2",
@@ -46,7 +46,7 @@
 		"@vitest/coverage-v8": "^4.1.7",
 		"eslint": "^10.4.1",
 		"tsx": "^4.21.0",
-		"typescript": "^6.0.0",
+		"typescript": "^7.0.0",
 		"typescript-eslint": "^8.61.0",
 		"vitest": "^4.1.7"
 	},

package/src/api/v3/index.ts

@@ -22,12 +22,13 @@ import {
 
 } from "../../certificate"
 import {
+	getPrivateKey,
 	getPublic,
 	split,
+	UnsupportedKeyError,
 } from "../../utils"
 import {
 	KeyParseError,
-	parsePrivateKey,
 } from "sshpk"
 import {
 	CertificateType,
@@ -63,6 +64,9 @@ const CaPublicKeyEndpoint = (env: SshCaBindings) => {
 				return c.text(`${pub.toString("ssh").trim()}\n`)
 			} catch (err) {
 				switch (true) {
+					case (err instanceof UnsupportedKeyError):
+						l.error(err.message)
+						throw new InternalServerErrorException(err.message)
 					case (err instanceof KeyParseError):
 						l.error("error parsing private key")
 						throw new InternalServerErrorException("error parsing private key")
@@ -120,7 +124,9 @@ const UserCertificateRequestEndpoint = (env: SshCaBindings) => {
 				try {
 					await recordCertificate(c.env, certificate, data.headers.Authorization.email)
 				} catch (err) {
+					// a certificate that is not recorded cannot be revoked, so do not issue it
 					l.error("there was a problem adding issued certificate to database", "error", err)
+					throw new InternalServerErrorException("there was a problem recording the issued certificate")
 				}
 
 				l.info("completed issuing certificate",
@@ -133,6 +139,9 @@ const UserCertificateRequestEndpoint = (env: SshCaBindings) => {
 				return c.json(response)
 			} catch (err) {
 				switch (true) {
+					case (err instanceof UnsupportedKeyError):
+						l.error(err.message)
+						throw new InternalServerErrorException(err.message)
 					case (err instanceof ApiException):
 						// re-throw any exisiting chanfana error
 						throw err
@@ -167,10 +176,7 @@ const RevocationListEndpoint = (env: SshCaBindings) => {
 				const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v))
 
 				// grab private key from secret store
-				const secret = await c.env.PRIVATE_KEY.get()
-
-				// parse key
-				const key = parsePrivateKey(secret)
+				const key = await getPrivateKey(c.env)
 
 				// generate KRL
 				const krl = new KRLBuilder(key)
@@ -194,6 +200,9 @@ const RevocationListEndpoint = (env: SshCaBindings) => {
 				})
 			} catch (err) {
 				switch (true) {
+					case (err instanceof UnsupportedKeyError):
+						l.error(err.message)
+						throw new InternalServerErrorException(err.message)
 					case (err instanceof KeyParseError):
 						l.error("error parsing private key")
 						throw new InternalServerErrorException("error parsing private key")
@@ -257,7 +266,9 @@ const HostCertificateRequestEndpoint = (env: SshCaBindings) => {
 				try {
 					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
 				} catch (err) {
+					// a certificate that is not recorded cannot be revoked, so do not issue it
 					l.error("there was a problem adding issued certificate to database", "error", err)
+					throw new InternalServerErrorException("there was a problem recording the issued certificate")
 				}
 
 				l.info("completed issuing certificate",
@@ -270,6 +281,9 @@ const HostCertificateRequestEndpoint = (env: SshCaBindings) => {
 				return c.json(response)
 			} catch (err) {
 				switch (true) {
+					case (err instanceof UnsupportedKeyError):
+						l.error(err.message)
+						throw new InternalServerErrorException(err.message)
 					case (err instanceof ApiException):
 						// re-throw any exisiting chanfana error
 						throw err
@@ -319,7 +333,9 @@ const HostCertificateRenewEndpoint = (env: SshCaBindings) => {
 				try {
 					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
 				} catch (err) {
+					// a certificate that is not recorded cannot be revoked, so do not issue it
 					l.error("there was a problem adding issued certificate to database", "error", err)
+					throw new InternalServerErrorException("there was a problem recording the issued certificate")
 				}
 
 				l.info("completed issuing certificate",
@@ -332,6 +348,9 @@ const HostCertificateRenewEndpoint = (env: SshCaBindings) => {
 				return c.json(response)
 			} catch (err) {
 				switch (true) {
+					case (err instanceof UnsupportedKeyError):
+						l.error(err.message)
+						throw new InternalServerErrorException(err.message)
 					case (err instanceof ApiException):
 						// re-throw any exisiting chanfana error
 						throw err

package/src/api/v3/schema.ts

@@ -237,8 +237,13 @@ export const createHostCertificateRenewEndpointSchema = (env: SshCaBindings) =>
 
 export const revokeCertificateEndpointBodySchema = (env: SshCaBindings) => (
 	z.object({
-			serial: z.bigint()
-				.meta({ description: "Serial number of certificate to revoke" }),
+			// sent as a decimal string as JSON cannot carry a bigint and
+			// numbers lose precision above 2^53
+			serial: z.string()
+				.regex(/^\d+$/)
+				.transform(BigInt)
+				.refine((v) => v <= 0xFFFFFFFFFFFFFFFFn, { message: "serial must fit in an unsigned 64-bit integer" })
+				.meta({ description: "Serial number of certificate to revoke", example: "12345678901234567890" }),
 			public_key: publicKey,
 			proof: proofOfPossession
 				.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),

package/src/certificate.ts

@@ -7,10 +7,9 @@ import {
 	identityForUser,
 	identityFromDN,
 	Key,
-	parsePrivateKey,
 	PrivateKey } from "sshpk"
 import { SSHExtension } from "./types"
-import { split } from "./utils"
+import { getPrivateKey, split } from "./utils"
 import type { SshCaBindings } from "./types"
 
 // const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
@@ -148,10 +147,7 @@ export const generateCertificate = (env: SshCaBindings, email: string, key: Priv
 
 export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate> {
 	// grab private key from secret store
-	const secret = await env.PRIVATE_KEY.get()
-
-	// parse key
-	const key = parsePrivateKey(secret)
+	const key = await getPrivateKey(env)
 
 	if (options === undefined) {
 		options = {
@@ -200,10 +196,7 @@ export async function createSignedHostCertificate(env: SshCaBindings, public_key
 	}
 
 	// grab private key from secret store
-	const secret = await env.PRIVATE_KEY.get()
-
-	// parse private key
-	const key = parsePrivateKey(secret)
+	const key = await getPrivateKey(env)
 
 	// lifetime is the smaller of what was provided in the options or the default
 	const lifetime = options.lifetime !== undefined

package/src/db/index.ts

@@ -30,13 +30,13 @@ const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
 	const l = logger(env)
 
 	try {
-		l.info("connecting to database")
+		l.debug("connecting to database")
 
 		const qb = new D1QB<DatabaseSchema>(env.DB)
 		const migrationBuilder = qb.migrations({ migrations })
 		const appliedMigrations = await migrationBuilder.apply()
 
-		l.info("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name))
+		l.debug("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name))
 
 		return qb
 	} catch (err) {
@@ -50,6 +50,7 @@ export const dbCleanup = async (env: SshCaBindings) => {
 
 	if (env.DB_CERTIFICATE_RETENTION === "infinite") {
 		l.info("skipping database cleanup")
+		return
 	}
 
 	l.info("starting database cleanup")